{"id":867,"date":"2009-10-06T22:01:04","date_gmt":"2009-10-06T19:01:04","guid":{"rendered":"http:\/\/www.void.gr\/kargig\/blog\/?p=867"},"modified":"2009-10-06T22:05:12","modified_gmt":"2009-10-06T19:05:12","slug":"ossec-to-the-rescue","status":"publish","type":"post","link":"https:\/\/www.void.gr\/kargig\/blog\/2009\/10\/06\/ossec-to-the-rescue\/","title":{"rendered":"ossec to the rescue"},"content":{"rendered":"

That’s why I love ossec<\/a>:<\/p>\n

OSSEC HIDS Notification.\n2009 Oct 06 17:45:17\n\nReceived From: XXXX->rootcheck\nRule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."\nPortion of the log(s):\n\nRootkit 'Suspicious' detected by the presence of file '\/var\/www\/vhosts\/YYYY.com\/httpdocs\/album_mod\/..  \/...\/.log'.\n\n --END OF NOTIFICATION\n\nOSSEC HIDS Notification.\n2009 Oct 06 17:45:17\n\nReceived From: XXXX->rootcheck\nRule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."\nPortion of the log(s):\n\nRootkit 'Suspicious' detected by the presence of file '\/var\/www\/vhosts\/YYYY.com\/httpdocs\/language\/lang_english\/     \/... \/.log'.\n\n --END OF NOTIFICATION\n\nOSSEC HIDS Notification.\n2009 Oct 06 17:45:17\n\nReceived From: XXXX->rootcheck\nRule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."\nPortion of the log(s):\n\nRootkit 'Suspicious' detected by the presence of file '\/var\/www\/vhosts\/YYYY.com\/httpdocs\/language\/     \/... \/.log'.\n\n --END OF NOTIFICATION<\/code2><\/pre><\/p>\n
Just found this by copying some files for a client from his previous hosting company to one of the hosting servers of a company I work for.<\/p>\n
There were actually 2 different sets of files.
\nThe first one contained a tool that “hides” a process, called: “XH (XHide) process faker”<\/em>, and the second one contained an iroffer<\/a> executable. <\/p>\n
Files:
\ni)xh-files.tar.gz<\/a>
\nListing:
\n.log\/
\n.log\/.crond\/
\n.log\/.crond\/xh
\n.log\/week~
\n.log\/week<\/code><\/p>\n
ii)iroffer-files.tar.gz<\/a>
\nListing:
\n.--\/
\n.--\/imd.pid
\n.--\/imd.state.tmp
\n.--\/imd.state
\n.--\/linux<\/code><\/p>\n
Mind the . (dot) of the directories containing the files.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
That’s why I love ossec: OSSEC HIDS Notification. 2009 Oct 06 17:45:17 Received From: XXXX->rootcheck Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)." Portion of the log(s): Rootkit 'Suspicious' detected by the presence of file '\/var\/www\/vhosts\/YYYY.com\/httpdocs\/album_mod\/..  \/…\/.log'. –END OF NOTIFICATION OSSEC HIDS Notification. 2009 Oct 06 17:45:17 Received From: XXXX->rootcheck Rule: 510 fired […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[3],"tags":[216,595,217,218,176,206,185],"class_list":["post-867","post","type-post","status-publish","format-standard","hentry","category-linux","tag-iroffer","tag-linux","tag-ossec","tag-process-hider","tag-rootkit","tag-security","tag-vulnerability"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t